Chính sách bảo mật / Privacy Policy

Betaschool English Center (“Betaschool”, “we”, “us”) is committed to protecting the personal information of students, parents, and staff when using our services, including:

• The website at https://betaschool.edu.vn
• The Betaschool Inside system (web at /inside and the mobile app on App Store / Google Play)
• The student portal and related APIs

This policy explains what data we collect, what we use it for, who we share it with, how long we keep it, and your rights over that data.

(a) Account information

• Students: full name, email, phone number, date of birth, student code, current class / course enrollment, attendance history, reward points, photos taken during sessions. Synced from the CenterUp management system (ant-learning.com) under our service contract.
• Parents: full name, phone, email (stored on the student record).
• Staff / Teachers: full name, company email, internal roles, CenterUp staff ID, password (stored as a bcrypt hash, not recoverable). Optionally a Microsoft 365 Immutable ID when SSO federation is enabled.

(b) Application usage data

• Push notification token: when a student installs the mobile app and grants notification permission, we store a device identifier (Expo Push Token) to send reward and schedule notifications. Maximum 5 tokens per student; older tokens are auto-replaced.
• Login session: HTTP-only cookies inside_session and inside_student_session, JWTs valid for 7 days.
• Comments / media content: teacher voice comments, session photos, attached files — stored on Backblaze B2 (US-West) and encrypted in transit.

(c) Technical data

• UI language preference (cookie inside_lang).
• Server error logs (status code + path only, no content) — kept for up to 30 days.
• Third-party API audit logs (CenterUp, OpenAI, Backblaze B2) — kept for up to 30 days for support purposes.

• To deliver our educational service: track progress, attendance, reward points, schedules, and learning content.
• To communicate with students and parents about schedules, points, or important notices.
• To improve teaching quality through teacher comments (parents may view these via the app).
• For secure login (password authentication, SSO federation with Microsoft 365 for staff).
• For fraud detection and system security.

We DO NOT use personal data for advertising, and we do not sell data to third parties.

We share personal data with the following service providers, strictly within the scope necessary for operations:

• CenterUp (ant-learning.com): learning-center management system — syncs student records, classes, attendance, tuition.
• Microsoft 365 (Entra ID): SSO federation for staff with @betaschool.edu.vn accounts.
• Backblaze B2 (US-West): media storage (photos, recordings, documents).
• Expo Push Notification Service: delivers push notifications to mobile devices via Apple APNs / Google FCM as appropriate.
• OpenAI: speech-to-text transcription (Whisper) and analysis of comment content. Data sent does not include student identifiers beyond names (when a teacher mentions a name in their comment).
• Cloudflare: DNS and CDN infrastructure.

All third parties listed above maintain their own privacy policies and contractually commit to applicable data-protection regulations.

• Account data (students, parents, staff): retained for the duration of the relationship with the center, plus 24 months afterward, for academic-record purposes.
• Teacher comments, recordings, session photos: retained for the student’s course duration, then deleted or anonymized 12 months after the course ends.
• Login-session cookies: expire after 7 days, or immediately when the user signs out.
• Push tokens: updated per device; max 5 tokens per student; deleted when the student uninstalls the app.
• Technical logs: 30 days.

You have the right to:

• View the personal data we hold about you (account, schedule, points, comments).
• Request correction of inaccurate information.
• Request deletion of your account and personal data (except portions we are required to retain by law).
• Disable push notifications in your device settings or within the app’s settings.
• Lodge a complaint with the relevant data-protection authority if you believe your rights have been violated.

To exercise any of these rights, please use the contact information in section 9.

• Passwords are hashed with bcrypt; we never store plain-text passwords.
• All web traffic is HTTPS (TLS 1.3 at the Cloudflare edge and through the cloudflared tunnel).
• Login sessions use HTTP-only, Secure, SameSite=Lax cookies.
• Admin access is restricted by role-based access control (RBAC) with internalRoles + permissions.
• Media stored on Backblaze B2 is access-gated by a dedicated application key.

Betaschool teaches children aged 6 and up. Student accounts for children under 13 are created and managed by parents / guardians via the center’s system. We do not knowingly collect data directly from children without parental consent.

Parents may request to view or delete their child’s data by contacting the center.

For any questions about this policy or your personal data, please contact us:

We may update this policy over time. New versions will be posted at https://betaschool.edu.vn/privacy with the effective date at the top of the page. You are encouraged to review it periodically.